Pith. Sign in

RECORD

Dependency Practices for Vulnerability Mitigation

PaperPDF from arXiv

data files

Paper breakdownThe authors' claims, conditions and measurements, as JSON Signed receiptProof this review has not been altered
X Bluesky LinkedIn Reddit Hacker News
Abbas Javan Jafari, Diego Elias Costa, Ahmad Abdellatif, Emad Shihab

Software Engineering · Submitted 11 Oct 2023

abstract compiled · 2026-09-23 · no language-model review

The authors' main claim Developers can incorporate our findings into their dependency management practices to mitigate the impact of vulnerabilities from their dependency supply chain.

how it is stated · hedged possibility 0.68 read the record →

Comment (0) Read on arXiv ↗
Cite ▾
arXiv ID2310.07847 (version 1)
Pith IDFGLH5CRM, Pith's permanent record of this paper and its review
CitationAbbas Javan Jafari, Ahmad Abdellatif, Diego Elias Costa, Emad Shihab. "Dependency Practices for Vulnerability Mitigation." arXiv:2310.07847 (2023). https://pith.science/paper/FGLH5CRM
Claim paper

The compiled record

The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.

Open the compiled record

Compiled by classifier-1.13.0 via TypeSafe API, question bank abstract-p1-20260923, 2026-09-23: 1 request, 6,823 input tokens.

What the abstract itself states, as probabilities: claims first 0.04 · states limitation 0.16 · human participants 0.82 · controlled comparison 0.05 · randomized assignment 0.01 · states quantitative result 0.98 · compares with prior results 0.08 · mentions code or data availability 0.04.

The abstract, sentence by sentence

arXiv listing abstract v1. Results and the main claim are underlined; .

Relying on dependency packages accelerates software development, but it also increases the exposure to security vulnerabilities that may be present in dependencies. While developers have full control over which dependency packages (and which version) they use, they have no control over the dependencies of their dependencies. Such transitive dependencies, which often amount to a greater number than direct dependencies, can become infected with vulnerabilities and put software projects at risk. To mitigate this risk, Practitioners need to select dependencies that respond quickly to vulnerabilities to prevent the propagation of vulnerable code to their project. To identify such dependencies, we analyze more than 450 vulnerabilities in the npm ecosystem to understand why dependent packages remain vulnerable. We identify over 200,000 npm packages that are infected through their dependencies and use 9 features to build a prediction model that identifies packages that quickly adopt the vulnerability fix and prevent further propagation of vulnerabilities. We also study the relationship between these features and the response speed of vulnerable packages. We complement our work with a practitioner survey to understand the applicability of our findings. Developers can incorporate our findings into their dependency management practices to mitigate the impact of vulnerabilities from their dependency supply chain.

background contribution method result interpretation main claim

What the classifier reports for each sentence. The number is the probability it gave the label.
#sentencerolethe authors' own workstates the main conclusionstrength
s0 Relying on dependency packages accelerates software development, but it also increases the exposure to security vulnerabilities that may be present in dependencies. background 1.00 0.05 0.05 asserted 0.89
s1 While developers have full control over which dependency packages (and which version) they use, they have no control over the dependencies of their dependencies. background 0.99 0.07 0.03 asserted 1.00
s2 Such transitive dependencies, which often amount to a greater number than direct dependencies, can become infected with vulnerabilities and put software projects at risk. background 1.00 0.07 0.04 asserted 0.57
s3 To mitigate this risk, Practitioners need to select dependencies that respond quickly to vulnerabilities to prevent the propagation of vulnerable code to their project. background 0.69 0.04 0.19 asserted 0.96
s4 To identify such dependencies, we analyze more than 450 vulnerabilities in the npm ecosystem to understand why dependent packages remain vulnerable. method 0.80 0.95 0.05 asserted 0.98
s5 We identify over 200,000 npm packages that are infected through their dependencies and use 9 features to build a prediction model that identifies packages that quickly adopt the vulnerability fix and prevent further propagation of vulnerabilities. method 0.54 0.97 0.25 asserted 1.00
s6 We also study the relationship between these features and the response speed of vulnerable packages. contribution 0.63 0.93 0.05 asserted 0.88
s7 We complement our work with a practitioner survey to understand the applicability of our findings. method 0.80 0.93 0.04 asserted 0.92
s8 Developers can incorporate our findings into their dependency management practices to mitigate the impact of vulnerabilities from their dependency supply chain. interpretation 0.52 0.12 0.43 hedged possibility 0.68

What kind of paper the classifier reports this is: empirical study 0.80 · evidence from analysis of existing data 0.90.

What was examined, and what was not

sources read
  • arXiv listing abstract v1
not examined
  • full text
  • figures and tables
  • references and citing sentences
  • relations to other papers
levels run
  • P abstract
not run
  • S sections
  • T body sentences
  • C citations
  • R cross-paper relations

Every quoted sentence on this record is the authors'. Every label is from Pith's closed vocabulary, with the probability shown beside it. Every number in the measurements table is the authors', checked by code. Record as JSON

The paper
Original abstract

Relying on dependency packages accelerates software development, but it also increases the exposure to security vulnerabilities that may be present in dependencies. While developers have full control over which dependency packages (and which version) they use, they have no control over the dependencies of their dependencies. Such transitive dependencies, which often amount to a greater number than direct dependencies, can become infected with vulnerabilities and put software projects at risk. To mitigate this risk, Practitioners need to select dependencies that respond quickly to vulnerabilities to prevent the propagation of vulnerable code to their project. To identify such dependencies, we analyze more than 450 vulnerabilities in the npm ecosystem to understand why dependent packages remain vulnerable. We identify over 200,000 npm packages that are infected through their dependencies and use 9 features to build a prediction model that identifies packages that quickly adopt the vulnerability fix and prevent further propagation of vulnerabilities. We also study the relationship between these features and the response speed of vulnerable packages. We complement our work with a practitioner survey to understand the applicability of our findings. Developers can incorporate our findings into their dependency management practices to mitigate the impact of vulnerabilities from their dependency supply chain.

Human review

How Pith checks papers → · Full audit of this paper →

References
How the literature uses it

2 arXiv papers cite this in 2 sentences

Each citing sentence is taken from the citing paper's LaTeX source and typed by Pith's classifier. A label appears at probability 0.8 or more (0.95 for support), a contest at 0.7 or more; the quoted words are the citing authors'. How each label was checked · JSON

Papers citing it · 1 sentence without a confident label

Cites it as background 1 paper

Discussion

Know something about this paper? Leave a comment, or highlight any passage above to comment on it.